+ BUILT_SOURCES += rust-slapi-private.h rust-nsslapd-private.h

+ noinst_LTLIBRARIES = librsds.la librslapd.la librnsslapd.la

+ # Build rust ns-slapd components as a library.

+ RNSSLAPD_LIB = @abs_top_builddir@/rs/@rust_target_dir@/librnsslapd.a

+ 

+ librnsslapd_la_SOURCES = \

+ 	src/librnsslapd/Cargo.toml \

+ 	src/librnsslapd/build.rs \

+ 	src/librnsslapd/src/lib.rs

+ 

+ librnsslapd_la_EXTRA = src/librnsslapd/Cargo.lock

+ 

+ @abs_top_builddir@/rs/@rust_target_dir@/librnsslapd.a: $(librnsslapd_la_SOURCES)

+ 	RUST_BACKTRACE=1 RUSTC_BOOTSTRAP=1 \

+ 	CARGO_TARGET_DIR=$(abs_top_builddir)/rs \

+ 	SLAPD_HEADER_DIR=$(abs_top_builddir)/ \

+ 		cargo rustc $(RUST_OFFLINE) --manifest-path=$(srcdir)/src/librnsslapd/Cargo.toml \

+ 		$(CARGO_FLAGS) --verbose -- $(RUSTC_FLAGS)

+ 

+ # The header needs the lib build first.

+ rust-nsslapd-private.h: @abs_top_builddir@/rs/@rust_target_dir@/librnsslapd.a

+ 

+ 			$(librslapd_la_SOURCES) $(librslapd_la_EXTRA) \

+ 			$(librnsslapd_la_SOURCES) $(librnsslapd_la_EXTRA)

+ 	RUST_BACKTRACE=1 RUSTC_BOOTSTRAP=1 \

+ 	CARGO_TARGET_DIR=$(abs_top_builddir)/rs \

+ 	SLAPD_HEADER_DIR=$(abs_top_builddir)/ \

+ 		cargo test $(RUST_OFFLINE) --manifest-path=$(srcdir)/src/librnsslapd/Cargo.toml

+ libslapd_la_LDFLAGS = $(AM_LDFLAGS) $(SLAPD_LDFLAGS)

+ libslapd_la_LDFLAGS += -lssl

+ if RUST_ENABLE

+ ns_slapd_LDADD += $(RNSSLAPD_LIB)

+ endif

+ 

+ 	-e 's,@enable_rust\@,@enable_rust@,g' \

+     # Since fernet uses the openssl lib.

+     PKG_CHECK_MODULES([OPENSSL], [openssl])

+ AC_SUBST([enable_rust])

+ # --- BEGIN COPYRIGHT BLOCK ---

+ # Copyright (C) 2019 William Brown <william@blackhats.net.au>

+ # All rights reserved.

+ #

+ # License: GPL (version 3 or any later version).

+ # See LICENSE for details.

+ # --- END COPYRIGHT BLOCK ---

+ 

+ import ldap

+ import pytest

+ import time

+ from lib389.idm.user import nsUserAccounts, UserAccounts

+ from lib389.topologies import topology_st as topology

+ from lib389.paths import Paths

+ from lib389.utils import ds_is_older

+ from lib389._constants import *

+ from lib389.idm.directorymanager import DirectoryManager

+ from lib389.idm.account import Anonymous

+ from lib389.extended_operations import LdapSSOTokenRequest

+ 

+ default_paths = Paths()

+ 

+ pytestmark = pytest.mark.tier1

+ 

+ USER_PASSWORD = "password aouoaeu"

+ TEST_KEY = "4PXhmtKG7iCdT9C49GoBdD92x5X1tvF3eW9bHq4ND2Q="

+ 

+ @pytest.mark.skipif(not default_paths.rust_enabled or ds_is_older('1.4.2.0'), reason="Auth tokens are not available in older versions")

+ def test_ldap_auth_token_config(topology):

+     """ Test that we are able to configure the ldapssotoken backend with various types and states.

+ 

+     :id: e9b9360b-76df-40ef-9f45-b448df4c9eda

+ 

+     :setup: Standalone instance

+ 

+     :steps:

+         1. Enable the feature

+         2. Set a key manually.

+         3. Regerate a key server side.

+         4. Attempt to set invalid keys.

+         5. Disable the feature

+         6. Assert that key changes are rejected

+ 

+     :expectedresults:

+         1. Feature enables

+         2. Key is set and accepted

+         3. The key is regenerated and unique

+         4. The key is rejected

+         5. The disable functions online

+         6. The key changes are rejected

+     """

+     # Enable token

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'on') # enable it.

+     # Set a key

+     topology.standalone.config.set('nsslapd-ldapssotoken-secret', TEST_KEY)

+     # regen a key

+     topology.standalone.config.remove_all('nsslapd-ldapssotoken-secret')

+     k1 = topology.standalone.config.get_attr_val_utf8('nsslapd-ldapssotoken-secret')

+     assert(k1 != TEST_KEY)

+     # set an invalid key

+     with pytest.raises(ldap.UNWILLING_TO_PERFORM):

+         topology.standalone.config.set('nsslapd-ldapssotoken-secret', 'invalid key')

+     with pytest.raises(ldap.UNWILLING_TO_PERFORM):

+         topology.standalone.config.set('nsslapd-ldapssotoken-secret', '')

+     # Disable token

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'off') # disable it.

+     # Set a key

+     with pytest.raises(ldap.OPERATIONS_ERROR):

+         topology.standalone.config.set('nsslapd-ldapssotoken-secret', TEST_KEY)

+     # regen a key

+     with pytest.raises(ldap.OPERATIONS_ERROR):

+         topology.standalone.config.remove_all('nsslapd-ldapssotoken-secret')

+ 

+ 

+ @pytest.mark.skipif(not default_paths.rust_enabled or ds_is_older('1.4.2.0'), reason="Auth tokens are not available in older versions")

+ def test_ldap_auth_token_nsuser(topology):

+     """

+     Test that we can generate and authenticate with authentication tokens

+     for users in the directory, as well as security properties around these

+     tokens.

+ 

+     :id: 65335341-c85b-457d-ac7d-c4079ac90a60

+ 

+     :setup: Standalone instance

+ 

+     :steps:

+         1. Create an account

+         2. Generate a token for the account

+         3. Authenticate with the token

+         4. Assert that a token can not be issued from a token-authed account

+         5. Regenerate the server key

+         6. Assert the token no longer authenticates

+ 

+     :expectedresults:

+         1. Account is created

+         2. Token is generated

+         3. Token authenticates

+         4. Token is NOT issued

+         5. The key is regenerated

+         6. The token fails to bind.

+     """

+     topology.standalone.enable_tls()

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'on') # enable it.

+     nsusers = nsUserAccounts(topology.standalone, DEFAULT_SUFFIX)

+     # Create a user as dm.

+     user = nsusers.create(properties={

+         'uid': 'test_nsuser',

+         'cn': 'test_nsuser',

+         'displayName': 'testNsuser',

+         'legalName': 'testNsuser',

+         'uidNumber': '1001',

+         'gidNumber': '1001',

+         'homeDirectory': '/home/testnsuser',

+         'userPassword': USER_PASSWORD,

+     })

+     # Create a new con and bind as the user.

+     user_conn = user.bind(USER_PASSWORD)

+     user_account = nsUserAccounts(user_conn, DEFAULT_SUFFIX).get('test_nsuser')

+     # From the user_conn do an extop_s for the token

+     token = user_account.request_sso_token()

+     # Great! Now do a bind where the token is the pw:

+     # user_conn_tok = user.bind(token)

+     user_conn_tok = user.authenticate_sso_token(token)

+     # Assert whoami.

+     # Assert that user_conn_tok with the token can NOT get a new token.

+     user_tok_account = nsUserAccounts(user_conn_tok, DEFAULT_SUFFIX).get('test_nsuser')

+     with pytest.raises(ldap.UNWILLING_TO_PERFORM):

+         user_tok_account.request_sso_token()

+ 

+     # Check with a lowered ttl (should deny)

+     topology.standalone.config.set('nsslapd-ldapssotoken-ttl-secs', '1') # Set a low ttl

+     # Ensure it's past - the one time I'll allow a sleep ....

+     time.sleep(2)

+     with pytest.raises(ldap.INVALID_CREDENTIALS):

+         user.authenticate_sso_token(token)

+     topology.standalone.config.set('nsslapd-ldapssotoken-ttl-secs', '3600') # Set a reasonable

+ 

+     # Regenerate the server token key

+     topology.standalone.config.remove_all('nsslapd-ldapssotoken-secret')

+     # check we fail to authenticate.

+     with pytest.raises(ldap.INVALID_CREDENTIALS):

+         user.authenticate_sso_token(token)

+ 

+ @pytest.mark.skipif(not default_paths.rust_enabled or ds_is_older('1.4.2.0'), reason="Auth tokens are not available in older versions")

+ def test_ldap_auth_token_disabled(topology):

+     """ Assert when the feature is disabled that token operations are not able to progress

+ 

+     :id: ccde5d0b-7f2d-49d5-b9d5-f7082f8f36a3

+ 

+     :setup: Standalone instance

+ 

+     :steps:

+         1. Create a user

+         2. Attempt to get a token.

+         3. Enable the feature, get a token, then disable it.

+         4. Attempt to auth

+ 

+     :expectedresults:

+         1. Success

+         2. Fails to get a token

+         3. Token is received

+         4. Auth fails as token is disabled.

+     """

+     topology.standalone.enable_tls()

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'off') # disable it.

+     nsusers = nsUserAccounts(topology.standalone, DEFAULT_SUFFIX)

+     # Create a user as dm.

+     user = nsusers.create(properties={

+         'uid': 'test_nsuser1',

+         'cn': 'test_nsuser1',

+         'displayName': 'testNsuser1',

+         'legalName': 'testNsuser1',

+         'uidNumber': '1002',

+         'gidNumber': '1002',

+         'homeDirectory': '/home/testnsuser1',

+         'userPassword': USER_PASSWORD,

+     })

+     # Create a new con and bind as the user.

+     user_conn = user.bind(USER_PASSWORD)

+     user_account = nsUserAccounts(user_conn, DEFAULT_SUFFIX).get('test_nsuser1')

+     # From the user_conn do an extop_s for the token

+     with pytest.raises(ldap.PROTOCOL_ERROR):

+         user_account.request_sso_token()

+     # Now enable it

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'on')

+     token = user_account.request_sso_token()

+     # Now disable

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'off')

+     # Now attempt to bind (should fail)

+     with pytest.raises(ldap.INVALID_CREDENTIALS):

+         user_account.authenticate_sso_token(token)

+ 

+ 

+ @pytest.mark.skipif(not default_paths.rust_enabled or ds_is_older('1.4.2.0'), reason="Auth tokens are not available in older versions")

+ def test_ldap_auth_token_directory_manager(topology):

+     """ Test token auth with directory manager is denied

+ 

+     :id: ec9aec64-3edf-4f3f-853a-7527b0c42124

+ 

+     :setup: Standalone instance

+ 

+     :steps:

+         1. Attempt to generate a token as DM

+ 

+     :expectedresults:

+         1. Fails

+     """

+     topology.standalone.enable_tls()

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'on') # enable it.

+ 

+     dm = DirectoryManager(topology.standalone)

+     # Try getting a token at DM, should fail.

+     with pytest.raises(ldap.UNWILLING_TO_PERFORM):

+         dm.request_sso_token()

+ 

+ ## test as anon (will fail)

+ @pytest.mark.skipif(not default_paths.rust_enabled or ds_is_older('1.4.2.0'), reason="Auth tokens are not available in older versions")

+ def test_ldap_auth_token_anonymous(topology):

+     """ Test token auth with Anonymous is denied.

+ 

+     :id: 966068c3-fbc6-468d-a554-18d68d1d895b

+ 

+     :setup: Standalone instance

+ 

+     :steps:

+         1. Attempt to generate a token as Anonymous

+ 

+     :expectedresults:

+         1. Fails

+     """

+     topology.standalone.enable_tls()

+     topology.standalone.config.set('nsslapd-enable-ldapssotoken', 'on') # enable it.

+ 

+     anon_conn = Anonymous(topology.standalone).bind()

+     # Build the request

+     req = LdapSSOTokenRequest()

+     # Get the response

+     with pytest.raises(ldap.UNWILLING_TO_PERFORM):

+         (_, res) = anon_conn.extop_s(req, escapehatch='i am sure')

+ 

+ enable_rust = @enable_rust@

+                      * can bind or not. THIS IS THE PASSWORD/TOKEN CHECK.

+                      *

+                      * We have to check the token FIRST because it only validates if something

+                      * is correct or not: the pw verify actually does a send_ldap_result if the

+                      * pw is wrong.

+                      *

+                      * this effectively means the flow is:

+                      * check token -> if valid continue

+                      * if invalid -> check password

+                      *              if password is invalid -> send err=49 (INVALID_CREDENTIALS)

+                      *              if password is okay -> continue

+                     rc = pw_verify_token_dn(pb);

+                     /*

+                      * If tokan auth was a success, flag as such in the conn. This is to prevent

+                      * token sessions renewing infinitely - only a primary auth factor can generate

+                      * a token session.

+                      */

+                     if (rc != SLAPI_BIND_SUCCESS) {

+                         rc = pw_verify_be_dn(pb, &referral);

+                         pb_conn->c_bind_auth_token = 0;

+                     } else {

+                         pb_conn->c_bind_auth_token = 1;

+                     }

+                      * if it was successful, and if we used a PW (else we replace the pw

+                      * with the token, which would be bad!)

+                     if (pb_conn->c_bind_auth_token == 0 && config_get_enable_upgrade_hash()) {

+ /* If available, expose rust types. */

+ #ifdef RUST_ENABLE

+ #include <rust-nsslapd-private.h>

+ #endif

+ static const char *extended_op_oid2string(const char *oid);

+ #ifdef RUST_ENABLE

+ static void

+ extop_handle_ldapssotoken_request(Slapi_PBlock *pb, char *extoid __attribute__((unused)), struct berval *extval) {

+     BerElement *ber = NULL;

+     struct berval *bvp = {0};

+     int32_t rc = 0;

+     char *token = NULL;

+     char *dn = NULL;

+     char *key = NULL;

+ 

+     key = config_get_ldapssotoken_secret();

+     slapi_pblock_get(pb, SLAPI_CONN_DN, &dn);

+ 

+     /* This function checks for nulls properly! */

+     token = fernet_generate_token(dn, key);

+     slapi_ch_free_string(&dn);

+     if (token == NULL) {

+         slapi_log_err(SLAPI_LOG_ERR,

+                       "extop_handle_ldapssotoken_request", "unable to generate fernet token\n");

+         send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL,

+                          "unable to generate token", 0, NULL);

+         return;

+     }

+ 

+     /* We have a token, let's send it. */

+     ber = der_alloc();

+     PR_ASSERT(ber);

+ 

+     rc = ber_printf(ber, "{is}", &rc, token);

+     slapi_ch_free_string(&token);

+     /* Finish preparing the response */

+     if (rc != -1) {

+         ber_flatten(ber, &bvp);

+     }

+     ber_free(ber, 1);

+ 

+     if (rc == -1) {

+         slapi_log_err(SLAPI_LOG_ERR,

+                       "extop_handle_ldapssotoken_request", "unable to generate ber structure for token\n");

+         send_ldap_result(pb, LDAP_OPERATIONS_ERROR, NULL,

+                          "unable to generate token", 0, NULL);

+         return;

+     }

+ 

+     slapi_pblock_set(pb, SLAPI_EXT_OP_RET_VALUE, bvp);

+     send_ldap_result(pb, LDAP_SUCCESS, NULL, NULL, 0, NULL);

+     slapi_log_err(SLAPI_LOG_INFO, "extop_handle_ldapssotoken_request",

+                   "ldapssotoken generated correctly.\n");

+     ber_bvfree(bvp);

+     return;

+ }

+ #endif

+ 

+ 

+     /*

+      * Are we attempting to generate an auth token?

+      * Auth tokens are generated outside of transactions, and are just part of the

+      * main server, so we do it now before consulting plugins - WB

+      */

+ #ifdef RUST_ENABLE

+     if (strcmp(extoid, EXTOP_LDAPSSOTOKEN_REQUEST_OID) == 0 && config_get_enable_ldapssotoken()) {

+         /*

+          * We want to generate an auth token for this user.

+          * Was this session already authenticated by a token?

+          * Are they anonymous?

+          */

+         char *dn = (char *)slapi_sdn_get_dn(&pb_op->o_sdn);

+         int32_t is_anon = 0;

+         if (dn == NULL || *dn == '\0') {

+             is_anon = 1;

+         }

+ 

+         if (pb_conn->c_bind_auth_token != 0 || pb_op->o_isroot || is_anon) {

+             send_ldap_result(pb, LDAP_UNWILLING_TO_PERFORM, NULL, NULL, 0, NULL);

+             goto free_and_return;

+         } else {

+             /* We have a valid user who authed by not-password, generate them a token. */

+             extop_handle_ldapssotoken_request(pb, extoid, &extval);

+             goto free_and_return;

+         }

+     }

+ #endif

+ 

+ typedef void * (*ConfigGenInitFunc)();

+     CONFIG_STRING_GENERATED,             /* A string that can be set, or is internally generated */

+ slapi_onoff_t init_enable_ldapssotoken;

+     void *initvalue;               /* init values */

+     ConfigGenInitFunc geninitfunc; /* An init value generator */

+      CONFIG_STRING, NULL, SLAPD_INIT_LOG_MODE, NULL},

+      CONFIG_ON_OFF, NULL, &init_auditlog_rotationsync_enabled, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCHOUR_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCMIN_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONTIME_STR, NULL},

+      CONFIG_STRING, NULL, SLAPD_INIT_LOG_MODE, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ACCESS_MAXNUMLOGS_STR, NULL},

+      CONFIG_SPECIAL_ERRORLOGLEVEL, NULL, SLAPD_DEFAULT_FE_ERRORLOG_LEVEL_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_errorlog_logging_enabled, NULL},

+      CONFIG_STRING, NULL, SLAPD_INIT_LOG_MODE, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_EXPTIME_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_accesslog_logging_enabled, NULL},

+      CONFIG_INT, NULL, NULL, NULL},

+      CONFIG_STRING_OR_EMPTY, NULL, NULL, NULL /* deletion is not allowed */},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_MAX_THREADS_PER_CONN_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_EXPTIME_STR, NULL},

+      CONFIG_STRING, NULL, NULL, NULL /* deletion is not allowed */},

+      CONFIG_ON_OFF, NULL, &init_errorlog_rotationsync_enabled, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCHOUR_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCMIN_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONTIME_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_INHISTORY_STR, NULL},

+      "", NULL},

+      CONFIG_ON_OFF, NULL, &init_pw_unlock, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_GRACELIMIT_STR, NULL},

+      CONFIG_STRING, (ConfigGetFunc)config_get_pw_admin_dn, "", NULL},

+      CONFIG_ON_OFF, NULL, &init_accesslog_rotationsync_enabled, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCHOUR_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONSYNCMIN_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_ROTATIONTIME_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_pw_must_change, NULL},

+      CONFIG_ON_OFF, NULL, &init_pwpolicy_local, NULL},

+      CONFIG_ON_OFF, NULL, &init_pwpolicy_inherit_global, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_MAXDISKSPACE_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_SIZELIMIT_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_MAXLOGSIZE_STR, NULL},

+      CONFIG_LONG, NULL, SLAPD_DEFAULT_PW_WARNING_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_readonly, NULL},

+      &init_sasl_mapping_fallback, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_MAX_THREADS_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_pw_lockout, NULL},

+      CONFIG_ON_OFF, NULL, &init_enquote_sup_oc, NULL},

+      CONFIG_STRING, NULL, NULL, NULL /* deletion is not allowed */},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_IOBLOCK_TIMEOUT_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_MAX_FILTER_NEST_LEVEL_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_LOG_MAXDISKSPACE_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINLENGTH_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINDIGITS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINALPHAS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINUPPERS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINLOWERS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINSPECIALS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MIN8BIT_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MAXREPEATS_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINCATEGORIES_STR, NULL},

+      CONFIG_INT, NULL, SLAPD_DEFAULT_PW_MINTOKENLENGTH_STR, NULL},

+      CONFIG_ON_OFF, NULL, &init_pw_palindrome, NULL},

+      CONFIG_ON_OFF, NULL, &init_pw_dict_check, NULL},